KitPloit - PenTest Tools!
Snuffleupagus - Security Module For Php7 And Php8 - Killing Bugclasses And Virtual-Patching The Rest!

https://1.bp.blogspot.com/-2JGM8u32OgM/YJgaQqr-dwI/AAAAAAAAWIE/365i9KiLqeA7S9fdpp0YAoOVu2wwfeV7gCNcBGAsYHQ/s320/snuffleupagus_1_sp.png Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire bug classes. It also provides a powerful virtual-patching system, allowing administrator to fix specific vulnerabilities and audit suspicious behaviours without having to touch the PHP code. Key Features* No noticeable performance impact
* Powerful yet simple to write virtual-patching rules
* Killing several classes of vulnerabilities
* Unserialize-based code execution
* mail-based code execution
* Cookie-stealing XSS
* File-upload based code execution
* Weak PRNG
* XXE

* Several hardening features
* Automatic secureand samesiteflag for cookies
* Bundled set of rules to detect post-compromissions behaviours
* Global strict mode and type-juggling prevention
* Whitelisting of stream wrappers
* Preventing writeable files execution
* Whitelist/blacklist for eval* Enforcing TLS certificate validation when using curl
* Request dumping capability

* A relatively sane code base:
* A comprehensive test suite close to 100% coverage
* Every commit is tested on several distributions
* An clang-format-enforced code style
* A comprehensive documentation
* Usage of coverity DownloadWe've got a download page, where you can find packages for your distribution, but you can of course just git clonethis repo, or check the releases on github. ExamplesWe're providing various example rules, that are looking like this: # Harden the `chmod` function
sp.disable_function.function("chmod").param("mode").value_r("^[0-9]{2}[67]$").drop();

# Mitigate command injection in `system`
sp.disable_function.function("system").param("command").value_r("[$|;&`\\n]").drop();Upon violation of a rule, you should see lines like this in your logs: [snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in /var/www/index.php:2, because the return value (0) of the function 'strpos' matched a rule.DocumentationWe've got a comprehensive website with all the documentation that you could possibly wish for. You can of course build it yourself. ThanksMany thanks to the Suhosin project for being a huge source of inspiration, and to all our contributors. Download Snuffleupagus

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Can anybody tell me a noob way to create a PGP key.

So thought I would try white house market out but it says I cannot buy without a PGP key.

How do I get one?

submitted by /u/XboxJon82
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How I find my first Stored XSS
https://filipaze.medium.com/how-i-find-my-first-stored-xss-c6f57155cc1a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I found a Stored XSS on a awkward placeContinue reading on Medium » (https://filipaze.medium.com/how-i-find-my-first-stored-xss-c6f57155cc1a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I find my first Stored XSS

I found a Stored XSS on a awkward placeContinue reading on Medium »
Read more...

Snuffleupagus - Security Module For Php7 And Php8 - Killing Bugclasses And Virtual-Patching The Rest!
http://www.kitploit.com/2021/05/snuffleupagus-security-module-for-php7.html

___________________________
@hacking_Attack
@Hacking_Video

Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Snuffleupagus is a PHP 7+ and 8+ (https://secure.php.net/) module designed to drastically raise the cost of attacks against websites, by killing entire bug classes. It also provides a powerful virtual-patching system, allowing administrator to fix specific vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) and audit suspicious behaviours without having to touch the PHP code.
Key Features
No noticeable (https://dustri.org/b/snuffleupagus-030-dentalium-elephantinum.html)performance (https://www.kitploit.com/search/label/Performance) impact Powerful yet simple to write virtual-patching rules Killing several classes of vulnerabilities Unserialize-based (https://www.owasp.org/images/9/9e/Utilizing-Code-Reuse-Or-Return-Oriented-Programming-In-PHP-Application-Exploits.pdf) code execution mail-based code execution Cookie-stealing XSS (https://en.wikipedia.org/wiki/Cross-site_scripting) File-upload based code execution Weak PRNG XXE (https://en.wikipedia.org/wiki/XML_external_entity_attack) Several hardening (https://www.kitploit.com/search/label/Hardening) features Automatic secure and samesite flag for cookies Bundled set of rules to detect post-compromissions behaviours Global strict mode (https://secure.php.net/manual/en/migration70.new-features.php#migration70.new-features.scalar-type-declarations) and type-juggling prevention Whitelisting of stream wrappers (https://secure.php.net/manual/en/intro.stream.php) Preventing writeable files execution Whitelist/blacklist for eval Enforcing TLS certificate validation when using curl (https://secure.php.net/manual/en/book.curl.php) Request dumping capability A relatively sane code base: A comprehensive (https://coveralls.io/github/jvoisin/snuffleupagus?branch=master) test suite close to 100% coverage Every commit is tested on several distributions (https://gitlab.com/jvoisin/snuffleupagus/pipelines) An clang-format-enforced code style A comprehensive documentation (https://snuffleupagus.rtfd.io/) Usage of coverity (https://scan.coverity.com/projects/jvoisin-snuffleupagus)
Download
We've got a download page (https://snuffleupagus.readthedocs.io/download.html), where you can find packages for your distribution, but you can of course just git clone this repo, or check the releases on github (https://github.com/jvoisin/snuffleupagus/releases).
Examples
We're providing various example rules (https://github.com/jvoisin/snuffleupagus/tree/master/config), that are looking like this: # Harden the `chmod` function
sp.disable_function.function("chmod").param("mode").value_r("^[0-9]{2}[67]$").drop();

# Mitigate command injection (https://www.kitploit.com/search/label/Command%20Injection) in `system`
sp.disable_function.function("system").param("command").value_r("[$|;&`\\n]").drop(); Upon violation of a rule, you should see lines like this in your logs: [snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in /var/www/index.php:2, because the return value (0) of the function 'strpos' matched a rule.
Documentation
We've got a comprehensive website (https://snuffleupagus.readthedocs.io/) with all the documentation that you could possibly wish for. You can of course build it yourself (https://github.com/jvoisin/snuffleupagus/tree/master/doc).
Thanks
Many thanks to the Suhosin project (https://suhosin.org/) for being a huge source of inspiration, and to all our contributors (https://github.com/jvoisin/snuffleupagus/graphs/contributors).

Download Snuffleupagus (https://github.com/jvoisin/snuffleupagus)

___________________________
@hacking_Attack
@Hacking_Video

JUST A SECOND, IS ALL IT TAKES…

In this article i am going to talk about my first bug that i had found recently which is nothing but the broken link hijacking.Continue reading on Medium »
Read more...

hacking: security in practice
A CTF-style walkthrough of the recent Exiftool arbitrary code execution vuln (CVE-2021-22204)

https://external-preview.redd.it/PdKVZ1GJSbINBZ9ZoBxUFkcD4XhK-49nP0yDFSpLQ9k.jpg?width=640&crop=smart&auto=webp&s=96030ca49557e271fac2ed69d8d0f8c663a1602f submitted by /u/thefloatgoat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Interesting spam technique on Amazon

So, the guy is an idiot, but a genius as well. Some dingus went and mass-changed thousands of listings on Amazon to a pair of shoes with a watermark to his website.

Somehow, he was able to bypass the approval requirements to submit a "new" photo, and now about 1,600 products (from my inventory alone), have been updated to this image (screenshots below)

He's an idiot because his photo was not high resolution enough to see the URL in the image...

https://imgur.com/a/igNvfW8

I figured the hacking community would appreciate some weird social engineering on a huge platform like Amazon.

submitted by /u/evohans
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Tell If Your Phone Is Hacked and How to Fix It

https://cdn-images-1.medium.com/max/1200/0*9quwIFdmgRvcM22h.jpg
A Resourceful Compilation of Indicators and Solutions

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What are the vulnerabilities in a database server and web server, and how do you mitigate it?

Vulnerabilities in web applications include a system error or a system weakness in a web application. They have been around for years…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hire a Hacker for Gmail Hacker.

https://cdn-images-1.medium.com/max/735/0*mQ3eaw-gzF9XXvOk.jpg
There are many reasons why it is important for businesses to hire a hacker for Gmail passwords.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video